When CMS Can See Every Denial
The June 2026 MCPAR prior authorization reporting requirement created the first standardized federal data set on Medicaid MCO denial rates. Most plans built their authorization workflows for a world where that visibility did not exist.
A new federal visibility layer, not a new reporting form
The first wave of standardized Medicaid prior authorization data is now flowing to CMS. Most health plan leaders have not fully processed what that means.
Beginning with the reporting cycle submitted in June 2026, the Medicaid Managed Care Program Annual Report (MCPAR) requires states to submit plan-level prior authorization data in standardized fields: total number of PA requests, denial rates, approval rates, the percentage of standard requests approved after appeal, and average and median decision timelines. For the first time, CMS holds a comparable data set across every Medicaid managed care organization in every reporting state.
This is not a minor administrative expansion. Prior to this cycle, Medicaid prior authorization data existed at the state level in fragmented forms. Some states collected denial rates. Some did not. Timeliness data was reported in varying formats, on varying cadences, under varying definitions. CMS had no standardized basis for comparison across plans or states.
The MCPAR revision changes that architecture permanently. CMS also told GAO in November 2025 that it was building an internal appeals and grievance dashboard to use this data for oversight, with planned implementation by June 2026 — precisely when the first MCPAR cycle went live. The timing is not coincidental.
Medicaid MCO prior authorization denial rate, compared with 5.7% in Medicare Advantage — as documented in a 2023 OIG evaluation
Source: HHS Office of Inspector General — Prior Authorization Denials in Medicaid MCOs
The OIG baseline that makes the MCPAR data meaningful
The OIG numbers were drawn from sampled data under inconsistent methodologies. They told a story about the Medicaid MCO population in aggregate. They did not produce plan-by-plan comparisons. The MCPAR data produces exactly that.
When CMS and state Medicaid agencies can see that one plan in a market denies at 8 percent while another denies at 19 percent, the compliance implications are immediate. High denial rates do not by themselves indicate wrongdoing. But they generate questions that plans should already be able to answer clearly and quickly.
The 7-day timeliness standard adds a second dimension. CMS-0057-F, effective January 2026, requires standard prior authorization decisions within 7 calendar days for plans subject to the rule. The MCPAR now captures average and median decision times.
Plans that have not validated their PA workflow timelines at the process level — not just at the policy level — will see the compliance gap in the data before they see it in a formal inquiry. Queue management, staffing, system routing, and FDR turnaround requirements all affect the actual median timeline. A 7-day policy and a 10-day median workflow are two different things.
The rollup risk most compliance programs have not addressed
Many Medicaid managed care organizations delegate prior authorization functions to specialty vendors, behavioral health managed care organizations, or pharmacy benefit managers. The arrangement is common and operationally rational. The compliance implication of MCPAR, however, runs in a direction most FDR oversight programs have not yet mapped.
The MCPAR submission is a plan-level report. States submit data on behalf of each plan they contract with, drawing from data the plan provides. If FDR-delegated PA data does not flow accurately into the state-submitted MCPAR data — because the FDR uses a different system, because the data pipeline was never formally designed, or because no one validated that the FDR’s PA volume was counted in the plan’s total — the plan’s submitted numbers may undercount total PA volume, misstate denial rates, or omit entire categories of PA decisions.
When CMS or a state oversight team reviews the MCPAR data, the plan’s submission is the record. The vendor’s system architecture is not a mitigating explanation after the fact. The accountability flows to the plan.
Behavioral health is where this risk concentrates. The June 2026 MCPAR cycle arrives shortly after the April 30, 2026 UM Annual Data Submission, which for Medicare Advantage plans required disclosure of internal coverage criteria — including FDR criteria. The OIG previously found that one in five behavioral health prior authorization requests in a reviewed MA sample was denied or modified. Plans that operate under behavioral health carve-outs should verify explicitly whether their MBHO’s PA decisions are captured in the MCPAR PA count.
The MCPAR prior authorization data does not exist in a neutral oversight environment. CMS is running the CRUSH initiative — Comprehensive Regulations to Uncover Suspicious Healthcare — with enforcement actions that include the largest Medicaid funding deferral in agency history ($1.3 billion from California), letters to all 50 state Medicaid programs on program integrity, and a formal review of every Medicaid Fraud Control Unit before its next annual recertification.
In June 2026, HHS denied Hawaii’s MFCU annual recertification — discontinuing federal funding — citing zero fraud convictions from 2022 through 2025. The decertification is the first concrete enforcement action under the MFCU review process, and a clear signal that federal oversight of the Medicaid program integrity infrastructure is active and consequences are real.
For MCOs, this context matters because the states they contract with are under their own pressure to demonstrate program integrity rigor. A state facing CMS scrutiny over Medicaid spending has every incentive to surface MCO compliance gaps rather than absorb them. The MCPAR PA data gives states a direct tool for doing exactly that.
The compliance gap is visible before anyone asks about it
Most Medicaid MCO compliance programs track prior authorization denial rates for clinical quality review purposes. They track appeal rates for member access monitoring. What most leadership teams do not have is a cross-functional view of what their plan-level denial rate looks like relative to MCPAR methodology, what their approval-after-appeal rate suggests about initial denial defensibility, and what a federal comparative data analysis of their market would reveal.
The MCPAR data makes that comparison possible — for CMS, for state Medicaid agencies, and eventually for OIG. Plans that have not already conducted that analysis internally are behind.
The compliance program cannot own this question alone. A plan-level denial rate that sits above market peers implicates clinical policy (are criteria defensible?), operations (is volume being counted correctly?), technology (does the data pipeline capture all PA requests?), and FDR oversight (is delegated PA volume included?). This is a cross-functional governance question, not a reporting one.
Oversight capacity tends to find what plans have not already found themselves. The MCPAR data is now flowing. The CMS dashboard is now operational. The MFCU review process is now active. Plans that wait for enforcement to surface their PA governance gaps are making a governance decision — even if it does not feel like one.
Until next week, stay briefed.
Why this matters
Five cross-functional implications for health plan leadership
Eight questions plan leadership should ask now
Common questions about this edition
What is the MCPAR prior authorization reporting requirement?
Beginning with the reporting cycle submitted in June 2026, the Medicaid Managed Care Program Annual Report (MCPAR) requires states to submit plan-level prior authorization data in standardized fields, including total PA requests, denial and approval rates, appeal-approval rates, and decision timelines. This is the first time CMS has held comparable, plan-by-plan prior authorization data across every Medicaid managed care organization in every reporting state.
What was the Medicaid MCO prior authorization denial rate before MCPAR standardization?
A 2023 OIG evaluation found Medicaid MCOs had an overall prior authorization denial rate of 12.5 percent, compared with 5.7 percent for Medicare Advantage at the time. Of denied Medicaid enrollees, 89 percent did not appeal, and only about one-third of those who did appeal succeeded, compared with an 82 percent overturn rate in Medicare Advantage.
What is the 7-day prior authorization timeliness standard?
CMS-0057-F, effective January 2026, requires standard prior authorization decisions within 7 calendar days for plans subject to the rule. The MCPAR now captures average and median decision times, so plans that have not validated their actual workflow timelines against this standard will see the gap in the federal data before they see it in a CMS inquiry.
Why does FDR-delegated prior authorization data create compliance risk under MCPAR?
Many Medicaid MCOs delegate prior authorization functions to specialty vendors, behavioral health MCOs, or pharmacy benefit managers. Because the MCPAR submission is a plan-level report, any gap in how delegated PA data flows into that submission can undercount total PA volume or misstate denial rates. The plan’s submission is the record CMS reviews, regardless of the vendor’s own system architecture.